@modelcontextprotocol/server@2.1.0
MCP TypeScript SDK 2.1.0 introduces request-time OAuth scope challenges, enforces body size and batch limits on Streamable HTTP transports, and fixes JSON-RPC handling for request ID 0 and protocol cancellations.
原始内容为英文；当前页面提供中文导航与来源说明，具体事实请以原文为准。
为什么值得关注
Version 2.1.0 of @modelcontextprotocol/server brings key security and protocol compliance improvements: - Request-time OAuth Scope Challenges : Tools, resources, resource templates, and prompts now support a scopeChallenge callback. When insufficient scopes are detected, createMcpHandler and Streamable HTTP transports issue an HTTP 403 challenge before executing handlers or establishing SSE. A requireScopes helper is included for static checks, and AuthInfo.resourceMetadataUrl is populated to construct RFC 8707-compliant WWW-Authenticate metadata headers. - Streamable HTTP Size and Batch Bounds : Introduces a default 4 MiB body limit ( DEFAULT MAX REQUEST BODY SIZE ) and a 100-message cap on JSON-RPC batch arrays, returning HTTP 413 or 400 respectively. Host/Origin checks now execute prior to reading bodies in Hono and Express adapters. - Protocol Compliance : Rejects modern (2026-07-28) POST requests lacking the mandatory MCP-Protocol-Version header with HTTP 400. Ceases sending invalid wire notifications/cancelled messages for the initialize handshake. - JSON-RPC Bugfixes : Correctly handles request ID 0 (and '' ) across cancellation abort signals and notification debounce logic rather than treating them as falsy/absent. - Error Chaining : SdkError and SdkHttpError now pass wrapped errors directly to standard Error.cause instead of error.data.cause (which is now deprecated).
可执行摘要
@modelcontextprotocol/server@2.1.0 adds scopeChallenge hooks for MCP primitives that return HTTP 403 with WWW-Authenticate headers on insufficient OAuth scopes. It also sets default 4 MiB payload limits and a 100-message batch cap on Streamable HTTP transports, rejects modern POSTs missing MCP-Protocol-Version headers with HTTP 400, treats ID 0 as a valid RequestId, and adopts native Error.cause chains.
- Agent 实用度
- 82/100
- 可信度
- 96%
- 机器格式
- JSON + Markdown
开发者应核对什么
- Ensure client implementations explicitly provide the MCP-Protocol-Version header on all modern POST requests to avoid HTTP 400 rejections.
- If handling payloads larger than 4 MiB or batch arrays larger than 100 messages via Streamable HTTP, configure maxRequestBodySize across server transport and adapter options.
- Update error handling logic in telemetry or logging to read from standard error.cause instead of the deprecated error.data.cause .